CVE-2018-14574

Nuclei

Django open redirect

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2018-14574.

Description

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Django

Browse PyPI / Django
GitHub Advisory2.0 to < 2.0.8 · Fixed in 2.0.8affected
1.11 to < 1.11.15 · Fixed in 1.11.15affected

Nuclei templates

1
ProjectDiscoveryMEDIUMDjango - Open RedirectCVSS 6.1

Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If django.middleware.common.CommonMiddleware and APPEND_SLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can craft a malicious URL that redirects users to a malicious website, leading to potential phishing attacks or the exploitation of other vulnerabilities.

Remediation

Upgrade to the latest version of Django or apply the relevant patch provided by the Django project.

WeaknessesCWE-601
Authorspikpikcu
Template tagscvecve2018djangoredirectdjangoprojectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:djangoproject:django"
https://www.djangoproject.com/weblog/2018/aug/01/security-releases/ https://usn.ubuntu.com/3726-1/ http://web.archive.org/web/20211206044224/https://securitytracker.com/id/1041403 https://www.debian.org/security/2018/dsa-4264 https://access.redhat.com/errata/RHSA-2019:0265 https://nvd.nist.gov/vuln/detail/CVE-2018-14574

Source: ProjectDiscovery

References

Showing 12 of 14